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(57) Abstract 

A digital satellite television system has a plurality of set-top-boxes associated^ with a plurality of end users* television receivers, 
a modem and a decoder housed in each STB, a Subscriber Authorization System (SAS) incorporating or having associated therewith a 
plurality of communication servers, means included in the SAS for generating Electronic Managements Messages (EMM), a back channel 
interconnecting each of the STBs individually with the SAS, means included In the SAS and each STB so that the necessaiy information 
required to inject a relevant EMM into the system Is supplied directly to the relevant communication server included in or associated with 
the SAS to authorise the release of the said EMM and/or means to connect the modem to the back channel and means whereby an EMM 
is transmissible to the decoder directly from a relevant communication server included in or associated with the SAS. Further important 
features are also disclosed. 
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KPOADCAST AND RECEPTION SYSTEM. AN D CONDITIONAL ACCESS 

SYSITEM THEREFOR 

The present invention relates to a broadcast and reception system, in particular to a 
mass-market digital interactive sateUite television system, and to a conditional access 
5 system therefor. 

In particular, but not exclusively, the invention relates to a mass-market broadcast 
system having some or all of the following preferred features:- 

• It is an information broadcast system, preferably a radio and/or television 
broadcast system 

10 • . It is a satelUte system (although it could be applicable to cable or terrestrial 
transmission) 

• It is a digital system, preferably using the MPEG, more preferably the MPEG- 
2, compression system for data/signal transmission 

• It affords the possibility of interactivity. 

15 .More particularly the present invention relates to so-called pay television (or radio) 
where a user/viewer selects a programme/fihn/game to be viewed for which payment 
is to be made, this bemg referred to as a pay-per-view (PPV) or in the case of data 
to be dovmloaded a so-c^led I>?XrP^"^* .('^?^-, 

With such known PPV or PPF. systems a significant amount x)f time is required to be 
20 spent by the user/viewer in .order to carry out the actions necessary to actually access 
the product being selected. . n 



hi- 



For example, in rae known systein the sequence of steps which have to be carried^put 
are as follows:- , ' 

I) The user tdepteones a so-called Subscriber Management System (SMS) 
25 which in this known system includes a number 6f iiuman operators which answer the 
subscriber's call and tp yhom the subscriber communicates the necessary information 
concerning the selected product and conceming-theTfinancial status of the subscriber 
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to a so-called Subscriber Authorization System (SAS) which has included in it or 
associated ^>yith it a plurality of comnjunications servers. . . 

- ii) The operator at .the.SMS then has to check the financial status of the 
user before authorising the connection from the qommiinications servers to.the user's 
5 television set so that the product can be delivered and viewed by the user. 

• ' • • • • z ; . ^ ■ . i , ' 1. i, ; . . ' • • 

In another known system the humas operator is replaced by an automatic ^voice server 
so that whqn the user telephones thq^SMS he/she hears a. v^icc activated recording to 
which tjtie user conveys the same information as . . 

This second arrangement reduces the delay inherent in the first described arrangement 
10 which caji . be more - easily overloaded ;when large numbers , of users are: wishing to 
: order a. product at, the S2ui)e: time, ; . ^r:? : . / . j 

However, even with this second: a^ajigement the inputting 
significant information in the form of lengthy serial numbers which operation provides 
plenty of scope for error? as well as being time consuming. : , 

The third known arrangement involves ithe/user- making :iise of , existing screen based 
systems such as MINriEL in France and PRESTEL in the United Kingdom, which 
' Systems replace fthe voice activated server, referred to.aboye in connection with the 
second arrangement. The MINITEL and PRESTEL systems themselves incorporate 
a modem at the -consumer end, 1.;.^ . \,' 

In all these known arrangements the user is inyplyed in the. expenditure of significant 
time and effort in inputting all the information necessary to enable the system to in 
effect authorize the transmission of: the. chpscnj product to the. user's television set. 

In.the case of a satellite ielevision system there is a further delay involved in the user 
actually receiving the product selected. 



15 



20 
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In PPV and PPF syifems the key element in cbntrbUing the user's access to products 
are so-called Entitlement Management Mcsslages (EMM) which have to be injected 
into the system in order to give the user product access. More particularly the EMMs 
arc the meChanisifi by which the encrypted data representative of a product is 
5 decrypted for a particular individual use^ * ^. • - ^ 

In known satellite television systems the EMMs are transmitted to the user's 
televisions via the satellite lirik at rejgiilaf- intervals in the MPEG-2 data sttcam. Thus 
in the case of a pahiculstf user-s EMNlMtBefdf can be a signific^t Mdelsfy of perhaps 
several minutes befogs the user's ne*t -EMM tfai^missit)ri arrives at that user's 
10 television set. 

Tbfe transiHission delay is-ih addilitfn to tli& delay referred to earlieS- which is^ihhercnt ^ 
in the user having to manually input certain datar5i«o the systemi: ^The curiiulatiye 
effect of these two delays is that it may ctake perhaps typically five minutes for a user 
^ to be able tb gain ac<2d^ td%e s^^^ --^ V . - i 

15 The present invention is concerned -with dverc6ming4his problem: - 

In a first aspect, the present invention ^ providesv.a conditional, access asystem - 
'CompriShig: " " - i^^T^-T'^^; -.m^ r: :t\ J-"^': 

means for generating^ plurality of preferably conditional access) messages; 
and ' ' ' ' ^. h bui:> : ^ t^l ..-rr:j->r ' . 

20 means for receiving the messages, said receiving jneans .being adapted to 

communicate with said generating means via a communications server connected 
directly to said generating means. ^ ' - . ' 

Prfcferably, the me&agc is an: eatitlei&ent message for transmission (for example by 
broadcast) to the receiving means, said generating means being adapted to generate 
25 entitldcnent messages- in itsponse^-to data received from said receivings means.: 

.j: r:'/' .. - * : /j- / " 

The generating means may be arranged to transmit a message as a packet of digital 
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data td said receiving means either via said xommunications server or via a satellite 
transponder; • " ■ '■ ' .-i^ ' . ^ • 

The receiving means may be eonnectable to said communications server via a modem 
and telephone link. 

In a related aspect, the present invention provides: a conditional access system for 
ia^ording conditional actesis to subscribers/comprism^ 

a subscriber management system; - . 

a subiscriber authorization system- coupled to: the subscriber -management 
system; and L 

a communications server; said server being connected directly to the subscriber 
authorization system. . r - : 

• : systeni- may Lfurther ^ c6mprise-^a rfor the subscriber, the 

- ' recciver/de^codcr being eonnectable to-said ^cdnimumcations server^^ a^ hence to said 
subscriber authorization systieiii^ via a modemvand telephone link; 

15 ]ji a second '^aspbct/'the pre^nt invention- provides a broadcast .^and reception ^^ystem 
including conditional access systcmi as described above:, r 

^ in a third aspect^ the present invendon provides and reception system 

comprising:-' ' - ^* ' • -Lrrbc:. •?/ .r " 

means for generating a plurality of entitlement messages relating to broadcast 
20 "-"programs;--" '- -^ ' ' - ■ ' '-^^ ^ "r.'-'^i l / ' 

means for receiving said messages from said generating means; and 
means for connecting the receiving means to the generating means to receive 
^ said messages, saiid connecting ihesdii-^ ^eiing'^ capable ^-^^ effectingra dedicated 
coimectidn between- the^ receiving meaiiis Md the generating means. 

25 The dedicated coimection would typically be a hard-wired coimection and/or a 
modemihed coimection, with the jpossibility of the connection been made via a cellular 



5 



10 
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'(■ telephone system. In other words,, the dedicated poonection is gapable of forming a 
channel of communication (from point to point). This is in contrast to broadcasting 
of information through the air or ambient medium. The connecting means would 

-typically be a modem at the receiving mieans.. i . -. j; - . 

5 Hence, in a closely related aspect, the present invention provides a broadcast and 
c* reception system comprising: . , * - > 

means for generating a plurality of cntitJpment mjpssiages relating to broadcast 
programs; • - . ^ •-. . 

' , ; : means for receiving said, messages, from said generating mcan§ via a modem; 

10 and 

! means-forcdnnectinffsaid modem to sefl^generating,m!?ans and said receiving \ 
means. ; v 

The above features cahoa{ford.-th6ciadYan.t^«P:'Qfopr<>yidii^ t|g: user:,the necessary 
v.- viewing authorizatioK<via.the EMM) ^njPre qiujcMy ;^an;.bas-hi^ertei^:b6^n possible, 
15 partly because, since the SAS. tyiMcally ijses- a spj.^ler amount of compute, cpde than 
the SMS, the SAS can operate more efficiently (and in real time), partly because the 
SAS can itself,.xiirectly, generatct the requisite SMM, ^nd-par^ly Jjeq^nse.the EMM can;£^ 
be passed to the user;or siibsCTibcr via a dodipated (Jypically rnqdenamed) lii^ ^- 

PreferaHy, the generating means is qonne«e4 ,to. said modem via; a qpnmnunications 
server which is preferably included in or associated with said generating means. 

The receiving means may be further adapted to receive said entitleme^tmcssagcs via 
a satellite transponder::. . r.;o /: • r.. ... : . . 

The receiving mtans. ma^-ber a-^ecejyer/jjpcoder coipprising means for receiving a 
compressed- MPEG-irtype; signal, means. fbr decoding the received signal to provide a 
television signal and means for supplying the television signal to a television. 

Preferablyvthe receiving imeans is adapted to commtmicate with said generating means 
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via said modem and comiccting means. The receiving means may comprise means 
for reading a smartcard insertable thereinto by an end user, the smartcard having 
^ , stored therein data to initiate, automatically the transmission Qf a messfage from said 
receiving means to said generating means upon insertion of the smartcard the end 
5 user. 

In addition, the system, niay further.rcpmprise a -voice link to .^a^le the end user of 
the broadcast and reception system ;to cpnimunicate with .the generating nicans. 

It will be understood from the above that the present invention : provides two 
arrangements by which the time it takes for an end user to access a desired product 
10 ,1 is reduced. Preferably both arrangements ,are: employed to ajchieve:the maximum time 
saving but either arrangement can be used t individually. - 

According :tQ a further aspect of the pres^ntymventi^ is provided ^a ^broadcast 

, and reception system, comprising^ the brQadcast end:; : ; j 
: a broadcast system including mc2ms%for to^ 
15 :v . and at the. reception end: r ; : - / ^ 

a.rcceiver including means for calling back the. broadcast^ s^ysteni i^ -response 
to the callback request. ^ - ^ < . . . . ' v 

By providing that thC: broadcast system can request the receiver: to call it back, the 
possibility is afforded of the broadcast, system; .obtaining information from the receiver 
about the state of the receiver. 

Preferably,- the means for calliijg back the bro^ inpludes a modem 

connectable to a telephone system. By using a modemmed back channel, a simple 
way of putting the invention JntO effect can ^be proyidejd.^ 

. Ji ■ i , ' ; ■ > . 

Preferably also, the means for calling back the broadcast system is arranged to transfer 
to the broadcast system infQnn?^tion..cpncerning the^feceiycr.;;^ information might 
include the number of remaining tokens, the number of pre-booked sessions, and so 
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on. 



Preferably, the bfoadcast'systcih ihcltides mea^ storing the information, so that 
it can be processed at a later time, as desirodi ^ ' . ^ 

Preferably, the broadcast means is arranged to broadcast a callback request which 
5 ' includes a command that the callback be m^de at a given ^timc^ and the means for 
calling -^back the broadcast systeit- is arranged to respond to said- conrniandl By 
arranging for the callback to be later than the actual request, greater flexibility can be 
imparted to thfe 'System/'* ^ ^ . : - . .. . 

The broadcasting iBfeans may be^arranged to tetodcast as the callback rfe^uast bnc or 
10 more Entitlement Messages for broadcast/ ^ ^ V: ' : 

Preferably, the bro^dc^t sykenf lAcludfe^ in^iihs fot ganerating a Chebfc Mess^^ge^ (such 
as a random number) aifd'passih^^lfis tdr-lKe reCeiVeT/the relieiVjcr inclu'diers means for 
encrypting' the chcfck messag^ arid" passing this to the broadcast system, and the 
broadcast system further includes means for decrypting the check message' received 
15 Vfrorh the receiver and compaWrig Jhis with the original ch^ In this w^y, 

it can be checked whether the receiver is genuine. - : - ^ . 

Any of the above features m^-l)e combined-together in^any appropriate combination. 
They may also be provided, iSB appropriaite> in^mdthod a^^^ 

Preferred features of the present invention will now be described, purely by way of 
20 example, with reference to the acconipanying drawings, in which:- : * : 

Figure 1 shows the overall aTdiiitccSture of a digi^^^ according to the 

preferred embodiment of the present invention; 

Figure 2 shows the' architecture of a conditional access system of the digital television 
system; • , • ^ .m ; : * 
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Figure 3 shows the structure of an , Entitlement Management Message used in the 
conditional access system; , . 



Figure 4 is a schematic diagram of the hardware ,of a Subscriber Authorisation System 
(SAS) according to a preferred embodiment of the present invention; 

5 Figure 5 is a schematic diagram of the architecture of the SAS; ^ 

Figure 6 is a schematic diagrain of ..a Subscriber Technical Management server 
forming part of the SAS; 

Figure 7 is a flow diagram of the procedure for automatic renewal of subtscaiptions as 
implemented by the SAS; 



10 Figure 8 is a schematic diagram of a group subscription bitmap used in the automatic 
renewal procedure; 



_ Figure 9 shows the structure of an EMM used in the automatic, renewal procedure; 
Figure 10 ^hows , in detail the structure of the EMM; , . , 

^Figure 11 is a schematic diagram of an order centradized server \vhen used to receive 
15 cpnunands directly through conmiunic^ . . , 

Figure 12 illustpte^ diagi;ammati«^^ part . of figure 2 showing one embodiment of 
t^ present invention; , > r,-. ^ . 

Figure 13 is a schematic diagram of the order, cen^alized server when used to receive 
. ; commands from the. subscriber authorization system to reqiiest a callback; 

20. Figure 14 is a schematic, dia^ . . 
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Figure 15 Shows the manner in which EMM 'emission cycle "rate is varied according 
to the timing of a PPV event; 

Figure'16 is a schematic ciiagram oi a Message Emitter used to emit EMKIs; 

Figure 17 is a schematic diagram showing the manner of storage of EMMs within the 
5 Message Emitter; . ^ - ' ^ J. 

Figuiffe 18 is^^a schematic dia^am of % smartcafd; - 

Figure 19 is a schematic diagram of an arrangement of zones in the memory of the 
sniaftc^nl;' and = - . . . 

Figure 20 is a schematic diagram of a PPV event description. 

10 An overview of a digital television broadcast and reception syStcifi IDOO ^cxordihg-to 
the present invention is shown in Figure 1. The invention includes a mostly 
conventionaiT'Wgital television system ' 2000 which "uses the known MPEG-2 
compression system to transmit compressed digital signals. In more detail, MPEG-2 
compressor 2002 in a broadcak centr^ receives a digital signal strecto (typically^ 

15 stream of video signals). The compressor 2002 is connected to a multiplexer and 
- scrambler 2004 by linkage 2^)06:' The tauitipiexdr 2004 receives a J)lurality of fiirther 
input signals, assembles oihe" or ibdrc tit&spdrt streams ijid transmits compressed 
digital signals to a transmitter 2008 of the broadcast centre via linkage 2010, which 
can- of course take 'a 'wide Variety' Of 'forms i6^ iiiiks. The transmitter 

20 2008 transmits electromagnetic signals via uplink 2012 towards a satellite transponder 
2014, where they are electronically processed and broadcast via notional downlink 
2016 to eaSth receiver 201*8; conventionally in the form of a dish own6d or rented by 
the end user; The^sighalis received by receiver 2018 are* transmitted to an' integrated 
receiver/decoder 2020 owned or rented by the end user and connected to the end user's 

25 television set 2022:' The recciver/decdder 2020 decodes the compressed MPEG-2 
signal into a television signal for the television set 2022. 
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A conditional access system 3000 is connected to the multiplexer 2004 and the 
receiver/decoder 2020, and is located partly in the broadcast centre and partly in the 
decoder. It enables the end user to access digital television broadcasts from one or 
. more broadcast suppliers, A smartcard, capable of decrypting messages relating to 
5 commercial offers (that i?, one or seyeral television programmes sold by the broadcast 
, supplier), can be inserted into the receiver/decoder 2020. Using the decoder 2020 and 
smartcard, the end uspr may purchasfe evjcnts in either a subscription mode or a pay- 
per-view mode. 

An interactive system . 4Q0p, also conne|Cted tfr the multiplexer 2004 and the 
10 receiver/decoder 2020 and jigain located partly in the broadcast centre and partly in 
the decoder, enables the end user to interact with various applications via a 
modemmed back channel 4002. 

The. conditional access system 3000 is now described in more detail. 

With reference to Figure 2, in overview the conditional access system 3000 inpludcs 
15 a Subscriber Authorization System (SAS) 3002. The SAS 3002 is coimected to one 
or more Subscriber Management Systems (SMS) 3004, one SMS for each broadcast 
supplier, by a respective TCP-IP linkage 3006 (although other types of linkage could 
altematiyely be used). Alternatively, one SMS could 
. suppliers, or one supplier. couW 

20 First encrypting units in the form of ciphering units 3008 utilising "mother" smartcards 
3010 are connected to the SAS by linkage 3012^ 

form of ciphering units .3014 iitiUsing mother smartcards 3016 are connected to the 
. multiplexer 2004 by linkage 3018. The receiyer/decoder 2020 receives a "daughter" 
smartpard 30^0. It is connected direptly tp^the SAS 3002 by Communications Servers 
25 3022 via the modemmed back, channel 4002. . The SAS sends amongst other things 
. subscpption rights to the c^ught^^ 



The smartcards coptain thp s.9crets of one or more (commercial operators. The 
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"mother" smartcard encrypts diffbfent kinds of messages and the "daughter" smaftcards 
decrypt the inessages, if they have the rights to do so. 

Thelfirst and second ciphering units 3008 ahd 3014 compriise a rack, an electronic 
VKtE card with software stored on an EEPiROM, up fo 20 electronic cards and one 
smartcikra 3010 and 3016 respectively, for each electronic card, one (card 3016) for 
encrypting the ECMs anS ohc (card 3010) for encrypiirig the £MKife. 

The operation of the conditional access system 3000 of the digital television system 
will now'be described in more detail with reference to the various components of the 
television system 20t)0 and the conditional access system 300^ 



10 Multiplexer and Scrambler 

With reference to Figures 1 and 2, in the broadcast centre, the digital video signal- is 
first compf^^ed (or bit ra^ red&3)f lis^^^ comt)i:fe&d?'2bd2:.' This 

compressed signal is then transmitted to the multiplexer and scrambler 2004 via the 
" i&kage'ioOd in <irder to be inuitipiexed^With btfier d^ta, '^ch a§ btlier compressed 

IS data. 

■ :.: ■ .... ■ . > '■ - '-'^ - ■ 

The scrambler geieratcss a control worff i^'d in the sc:ramblii^"^rbceSS and included 
in the' MPEG-2 streain in th6 miiltipicxer 2i0d4. The cbiitrol'wbra is generated 
internally and enables the end ukr*s iitegratdd Sfeceiiver/decoder 2020 to descramble 
the programme. 

20 Access criteria, indicating hbw the prograitlme is commerctalisea;''afe'dso added to 
the MPEG-2 Stream! ' TTie programme comniercialised iii eithet one of a 

number of "subscriptioh" nibdes 'and/or^^d^^^ of a number of "'P&y Per View'' (PPV) 
modes or events. In the subscriptioii mode, the end user subscribes' to bne or more 
commercial offers, c>r "boii^uets", thiis ^ettiiig the righfe to watch every channel inside 

25 those bouquets. In the preferred einbddimeinti'up to 960 coimmerdal offers may be 
selected from a bouquet of channels. In the Pay Per View mode, the end user is 
provided with the capability t6 purchase eVeiitis as he Widies. This can be achieved 
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by either pre-booking the event in advance ("pre-bo6k mode"); dr by purchasing the 
event as soon as it is broadcast ("impulse: faiode")'. In thfe^prefeixed- embodiment, all 
users are' subscribers, whether or not they watch in subscription dr PPV mode, but of 
course PPV viewers need not necessarily be subscribers. ' ^ '-'^ 

5 Both the control word and the access criteria are used to build an Entitlement Control 
Message (ECM); this is a message seiit in relation with one scrambled program; the 
niessage contains a control word (which allows for the descraniblirig Of tli6 program) 
and the access criteria of the broadcast pro^anii. The access criteria £md control word 
are transmitted to the second encrypting unit 3014 via the linkage 3018. In this unit, 
10 an ECM is generated, encrypted zdid transmitted oh to the rhultiplexcr and krfambler 
2004: ■ -f- i:: • ...t.r. : • - .7- ' '"'r:'^ 

■Each service broadcast by a brGadeast'siipplier in a'dMa stream comprises a number 
of distiiict conipohents; for ^exairipre • a-^ television prdgf amine includes a " video 
- component, an audio component, ia sub-titled C0EQp>Qnerit and iso 6h. * Eacli 6f these 
15 components of a Service is individuMly scrambled and -encrypted for subsequent 
" broiadeiast to the transponder 20i4. In respect: of eadh scrambled component of the 
service, a separate ECM is required. • ' * * - , - - 

• . i • 

Programme Transmission 

The multiplexer 2004 receives electrical signars'xiompfising eric^^ the 
20 SAS 3002, encrypted EGMs from the second encrypting unit 3014 and compressed 
programmes from the compressor 2002. The multiplexer 2004 scrambles the 
prograniiries andirarisnaits the scrambled prolamines, the encrypttid EMMs and the 
encrypted ECMs as electric -signals to a transmitter 2008 of the broadcast centre via 
linkage 2010. The transmitter 2008 transmits electromagnetic signals towards the 
25 satellite transponder 2di4 via' uplink^ 2012.^^^^^^^^ * 

Programme Reception - ' ^ - > ' 

The satellite transponder 2014 receives and processes the electromagnetic signals 

transmitted by the tiansmitter 2008- and tf^mits the signals on ito the earth receiver 
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t ^ 2QljB, conventionally in the fornj of.a dish owned or: rented .by the end user, via 
downlink 2016. The signals received by : receiver -2Q18 arc transmitted to the 
integrated receiver/decoder 2020 -owned or rented by Jthe end user and. connected to 
the end user's television .^et 2022..- The rccpiver/decoder 2020 deinultiplexcs the 
5 signals to obtain scrambled programmes with encrypted EMMs and encrypted ECMs. 

If the programme 15 not scrambled, that is, no:ECM has been transmitted with the 
/ .MPEG-2 stream,- the receiver/decodef.202&4€;compresses. the data and transforms the 
sigi^al into a. vidcQ signal for transj^iissioQ to television set 2022. 

. If the progrfuni^e sc7ambled,';th^^eQQiv.er/decod6c ^020 extra.cts the corresponding 
10 ECM from the MPEG-2 stream and passes the ECM to the "daughter" smartcard 3020 
of the end user. This slots into a housing in the receiver/decoder 2020. The daughter 
. smartcard; 3020 eontrplsr/Wji.ether end;M$^ JtiAS; the right to decrypt the EGM and., 
r : tQ access . the prog^aanpie. nlf^iiot^'^tfnjegaljy;^. status is pa&s/^d. to^ftljjs re^eiy^/decoder ^ 
2020 to indicate th^%t the-^QgranOTft-cm^iQt bfjj^sc^ambled. K th^itendjuser doeS:.^ 
15 have thq rights, tJiCj ECM is^^ecryplted apd thpj control >ypr4 extracted. . The -decoder r 
} ,2020 cap then descramblc-, the;, programme using this control word. 'Pie >lPEG-2, 
stream is decompressed and translated into a video signal for onward transmission to 
television set 2022. 

Subscriber Management System t tSMS)- . 
20 A Subscriber Majii&gempnt-i.§yste;il^X^^ which; 
manages, amongst otheir$,r4lLpf]the cndpser.fii^, commerciakqffcKXsuch as tariffs 
and promotions), subscriptions, PPV details, and data regarding ejp4^user ^^^^ 
and authorization. The SMS. may -be: physically iregip^^ from .ther SAS. 

Each SMS 3004 transmits messages tp-tJic.^AS 3002 via respective jii^ 3006 
25 which imply modifications to or creations of Entitlement Management Messages 
(EMMs) to be transmitted to end users. • . . , ;: - . - 

The SMS 3004 also transmits incssages . to the SAS. 3002 which - imply no 
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modifications or creations of EMMs l?ut. imply only a change in an end user's state 
(relating to the authorization ^ntcd to the" end yscr when ordering products ;0r to the 
amount that the end user will be charged). 

As described later, the SAS 3002 sends messages (typically requesting information 
5 such as call-back information or billing information) to the SMS 3004, so that it will 
be apparent that communication bet\y!eei\ the two is two-way. 

>' r., '• ■ :. r'i. . ., , • ■ • ■.■ ^. 

Entitlement Management Messages flEMMs't 

The EMM is ^ message dedicated to an individuah end user (subscriber), or a group 
of end users, oniy (in contrast with an iCM, wljiph is dedicated to one scrambled 
10 programme only or a set of scrambled programmes if part of the same commercial 
offer). Each group may contain a given number of end users. . Tlus organisation as 
groiip aims at optimising Ae bM^ that is, access to one^pup can permit the 
, reaching of a great number of end users. 



Various specific types of EMM are used m putting the present invention into practice. 

15 Individual EMMs are dedicated to individual subscribers, and arc typically used in the 
provision of Pay Per View services; these contain the grot|p identifier and the position 
of thp subscriber in that group. So-called "Groui>" subscription EMMs are dedicated 
to groups of, say, 256 individual Hsers, and are typically used in the administration of 
some subscription services. This EMM has'a group ideritifier and a subscribers' 

20 group bitmap. Audience EMMs are dedicated to entire audiences, and might for 
example be used by a particular operaitor to provide. certain free services. An 
"audience'V is the totality of subscribers haying smaijcards which bear the same 
Operator Iden_tifier .(OPI). FmaUy, . a //unique:^ EM^ is addressed to the unique 
identifier of the. srnartcard. ; , .. ~- , . 

25 The structure of a typical EMM is now described, witlj reference to Figure 3. 
Basically, the EMM, wWch is implemented as. a series of digital data bits, comprises 
a header 3060, the EMM proper 3062, and a signature 3064. The header 3060 in turn 
comprises a type identifier 3066 to identify„ whether the type is mdiyidual, group, 
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auidience or some other type, a length identifier 3068 which gives the length of the 
EMM, an optional address 3070 for the EMM, an operator identifier 3072 and a key 
identifier 3074. The EMM proper 366i'of course varies greatly according to its type. 
Finally, the signature 3064, which is typically of 8 bytes long, provides a number of 
5 checks against comiphon of the' rcmainiii^^^ 

Subscriber Authorization System (^AS) 

The messages generated by the SMS 3004 are passed via linkage 3006 to the 
Subscriber Authorization System^ (SAS)" 3002, which in turn generates messages 
acknowledging receipt of the messages generated bylthe* SMS 3004 and passes these 
10 acknowledgements to the SMS 3004. 

As shown in Figure 4, at the hardware level the SAS comprises in known fashion a 
idiainframe coniputer 30^0 (in the pfeferred emboidiment a DEC machine) c6nnected| 
to one or more keyboards 3052 for (^ta 'and command input^ one ot more^ VisualV 
Display Units (VDUs) 3054 for display of output information and data storage means^ 
15 3056. Some redundancy in hardware may be provided. * ^ 

'At the software lever the SAS runs, in the preferred embodiment on a standard open 
'VMS operating system, a suite of software whose' architecture is now' described xti 
overview with reference to Figure 5; it will be understood that the software could 
alteratively be implemented in hardware. 

20 In overview the SAS comprises a Subscription Chain area 3100 to giVe rights for 
subsoiption mode and to renew the ri^ls automatically each month, a I^ay Per View 
Chain area 3206 ^to give rights for* PPV events, arid an fiMM Injector 3300 for passing 
EMMs created by the Subscription and PPV cham 'areas to the niultiplexer and 
scrambler 2004, and hence to feed the MPEG stream with EMMs. If other rights are 

25 to be granted, such as Pay i^er File (PPF) rights in the case of downloading computer 
software to a user*s Personal 'Computer, other siniirkr iareas axe also provided. 

' One function of tSe SAS 3002 is to manage the access rights to television 
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^ .tprograinincs, available as commercial offers in. subscription. mo<3e or, sold -as PPV 
.events acQording to different modes of commercialisation (pre-book mode, impulse 
. mode). The SAS, 3002, according to those.rights and to information received from the 
SMS 3004, generates EMMs for the subscriber 

5 The Subscription Chain area 3100 comprises a Command Interface (CI) 3102, a 
Subscriber Technical jManagepicnt (ST^ 3104, a Message generator ?(MG) 

3106, and the Ciphering Unit 3008. , ; ; : ; ; / , r. 

, The PPy Chain area. 3200 comprises an Authprisa.hQn Server (AS) 3202, a relational 
database, 3204 for storing relpyant details of the end users, a iocai blacklist database 
10 3205, I)atabase Seryers^ 3206, for the database; an Order Centralized Scrve?r (OCS) 
, ,3207, a Server for Programme Broadcaster (SPB 3208, a Message Generator (MG) 
3210 whose function is basically the 5^e as that for, the Subspription Chain area and 
is hence not described further in any detail, and the Ciphering Unit 3008. 

. / The EMM Injector 3300 comprises a plurality, of Message Egiitters (MEs) 3302, 3304, 
15 3306 and 3308 and Software Multiplexeis (SMU3&) 3310 ancj 3312. In the prefeired 
embodiment, therp are t^vp MEs, 3302 at^d 3304 jfor the Message Generator 3106, with 
the other two MEs 3306 and 3308 for the Message CJenejij^tor 3210. -MEs 3302 and 
3306 are connected to the SMUX 3310 whilst MEs 3304 and 3308 are connected to 
. the .SMUX 3312; ... /'* ' r^r , . . 

20 Each of the three main components of the SASXthe Subscription Chain area, the PPV 
Chain are?^ and the, EMM Injector); are no^y qonsidered^i; mc)re detail. . 

Subscription Chain Area - r , „ 

Considering first the Subscription Chain area 3100, the Command Interface 3102 is 
primarily for despatching messages from the SMS 3004 to the STM server 3104, as 
25 well as to the OCS 5206^. and ftomtthe.OCS to the, SMS. The Command Interface 
takes as /input from the , SMS either direc^ conimands or batch files containing 
comxnands. It performs , syntactig analysis pn^fte messages coming fi-om the STM 



BNSDOCID: <WO_98434a6Al_l > 



wo 98/43426 PCT/EP97/02108 

- -17- - 

server, and is able to emit accurate messages when an error occurs, in a message 
(parameter out of range, missing^ parameter, and so on): It traces incoming commands 
' ' in textual form in a trace- file 3110 and also in binary form in a replay file 3112 in 
order to be able to replay a series of commands. Trades can be disabled and the size 
5 of files limited. 

Detailed discussion of 'the SiTM server 3104' is 'now provicied with particular reference 
to Figure 6. The STM server is effectively the main engine bf the Subscription Chain 
area, and has the purpose of managing free rights, the creation of new subscribers and 
the renewal of existing' subscribers\ As shown in' the fiigurei commands are passed on 
10 ^to the Message ^Senerlator 3106, albeit iii -* different fbrmat from' that in which the 
commands ai*6 pSSs'edF-to^the STKf servcri ' -For each c^ntariand" the STM server is • 
arraiiged to^fend an acknowledgeinent mesis'age to'^^the CI only when- the relevant 
cominaird has beetf^ficcesrfulF^ pr^^ ' ^ . v ^ 

The STM server includes a subscriber database 3120, in which all the relevant 
15 parametSrs of the subscribe!^ ire^ stored (IsnSattca^ eommerciil offersi, state, 

group and position in th6 groifp); ^andr' so oM), The' databaiSe-pcfforras seihantic^hecks 
of the commands ^enJ'by the GJ 3ld2^agamst the content of the database, and updates 
the database v^en the cbiknMridis a^^^ - ^ - 

The STM server further manages a First In First Out (FIFO) buffer 3122 between the 
20 STM server and the MG, as well as a backup disk FIFO 3124. The purpose of the 
• FIFOs is to average 'the flow of cdmiriands firom th# CT if the MG is not "able to 
respond for a while f6r^any4eaS6ri. They catf^aliso^^nSUfei that iif the case -of a crash 
of the STM server or MG no conomand will be lost, since the STM server is arranged 
to empty (that is, send to the MG) its FIFOs wiieh rcsiafteU .The .HFO^ are 
25 implemented as files; - - ^ '"^ ^--^ ^ • '-^ • ^ ^ • ■ 

' The STM server includes- at its- core an automatic renewal server 3126 which 
automatically generates renewals, and; if-required'by the operators, free rights. In this 
context, the generatioii of renewals iiay be thought of as- ihduding the generation of 
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rights for the first time, although, it wUl be understood that the generation of new 
rights is initiated at the SMS, As will become apparent, the two. can be treated by 
roughljr the same commands and EMM?. - . ^ 

■ J., " ■ ■ 

Having the STM separate from the SAS, and the automatic renewal server within the 
SAS rather than (in Jmown systenjs) i^ the SMS 3004, is a particularly important 
feature, since it can^ignifica^tly ^uce,jthe nimiber. of qommands which need to be 
passed from the SMS to the SAS,,(bearing jnpind that the SMS apd SAS may be in 
different Ipcatipns an(J operated^ by different, operators). In ^ct, the two main 
commands required from the SMS are merely commands that a new subscription 
shouId .be started and that, an existing subscriptio^^should be stopped (for example in 
flie case of non-payment). By minimisi^ig comman(| exchange between ,the SMS and 
SAS, the possibility of failure cjf comniapd transfer, in the linkage 3006 between the 
two is reduced; also, the design of the .SMS dpp to , take into account the 

features of the conditional access system 3000 generally. 



Automatic renewalprpceeds in ^e fashion indicated in the flow diagram of Figure 7. 
In order to reduce bandwidth, and given that a very high percentage of all renewals 
, arc standard, reneyv^al proceeds in groups pf subs<^bcrs; in the preferred embodiments 
ther<? are 256 individual subscribers petgroup:. T^ie flow diagram begins with the start 
step 3130, and proceeds to step 3132 ,^here . a monthly activation of the renewal 
20 function is made (although of course it will be appreciated that other frequencies are 
also. possible). With a monthly frequency, rights, are given to the enjd user for the 
. .. ciment moiith and^ all of the .followm^ they expire if not 

.■. renewed..,/, . 



In step 3134 the subsc^ber d^t^base 3120Js,acw:Me^ each group and 

each individual within that group to determine whether rights for the particular 
individual are to be renewed.. . ... . , , . ^ , . , . , 

In step 3136, a group subscription bitoap is. set. up aq^rding to the contents of the 
subscriber database, as shown in Figure 8. -^Th^ bitmap comprises a group identifier 
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(in this ca^e Group 1 - "Gl") 3138 and 256' individual subscriber zones 3140. The 
•'iiidividuar'bits in the bitmap arc set to 1 or zero 'according to whether or not the 
particular subscriber is to have his rights? reneWed. A typical set of binafy data is 
shown in the figure. 

, . . . . . • ^ • .,-.*7 • ' • - ... .\: ■ 

5 In step 3r42 the appropriate commands; including the group subscription bitmap, are 
" jiassed tci the Klessajge Generator 3106. In Stejp §1431 the Message Geher^^ an 
' obsolescefice date' to indicate to'the smartcardl the date beyond which the particular 
subscription EMM is nbt valid; typically this date is set as the end of the next month. 

:*~;"i'C " ' . ■ . ..... - 

In step 3144 the ^Micssage Geherator^ general the commands appropriate group 

10 subscription EMMs iand ^teks the Ciphering Unit 3008 to cipher the EMMs, the 
ciphcted EM>^s bcin^ thcn^ passed tb the EMM Injector 3300, Which/ in step 3146, 
^■^^ iigetisrthe EMMs ^^ito thd M?^ . ^ . . 

Step 3148 indicates that the above described procedure is repeated for each and every 
group. The process is finally brought to an ehd at Stop step 3150: 

15 ' The flow diagrairi' described above with reference tb Figiire 7 fclates in fact 
specifically to thV^tiewail of Subs^ptionS^. The STM alsd manages m a similar way 
free audience ri]^ts aiid new ^ubscriberis. 

In the case of free auciience rights, "aVkilSLblc foi' spefcific television prograrnmes or 
• groups of such programmes, thesae are ma:de available by the STM issuing a command 
20 to the Message Generator to generate appropriate audience EMMs (for a whole 
audience) with an obsolescence date a given number of days (or weeks) hence. The 
MG computes the precise' ob^tescehce dkte based on ihe STM coinmand^ 

In the case of new subscribers, these are dealt with in t^6 stages. 'Firstly, bn purchase 
the smartcard in the receiver/decoder 2020 (if desired by the operator) affords the 
25 subscriber free rights for a '^iven period (typically a f^w days). This is achieved by 
• generating a bitmap fdr the subscriber which includes the relevant obsolescence date. 
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The subscriber then passes his completed paperwork to the operator managing the 
subscriber (at the SMS). rOnce the paperwork has been processed, the SMS supplies 
to the.SAS a start comnjand for that particular subscriber. On re;ccipt by the SAS of 

. the start command, the STM commands ^the MG to assign, a; unique address to the new 
5 . , subscriber (with ai partieular group, number and position within the group) and to 

. generate a special, so-called "commercial offer" subscriptiop EMM (as opposed to the 

; more usual "group!' subscription EMM ^used for renewals) to provide the particular 
subscriber with rights until the end of the next month. . ^rom this po|nt renewal of the 

. subscriber can occur automatically as described above. By this two stage process it 
10 ^ is possible to grant new subscribers rights until the, SMS issues, a stop command. 

It is to be noted that the commercial offer subscription EMM is used for new 
subscribers and for reactivation of existing subscribers,. The group.subscription EMM 
. . is used for renewal Md suspension purposes^. ■.; 

■ With reference. to Figure 9, atypical subscqptijan Ef^lM, proper (that is, ignoring the 
15 , header and signature) generated by the above procedure .comprises the following main 
portions, namely typically a 256 bit subscription (or sutecribers' group) bitmap 3152, 
128 bits of management ciphering keys 3154 for the ciphering of the EMM, 64 bits 
of. each exploitation ciphering key 3156 to ^enable, the smartcard 3020 to.desrapher a 
control word to provide access to broadcast prpgrammeSi and 16 bits of obsolescence 
20 date 3158 to indicate the date beyond which the smartcard will ignore the EMM. In,- 
fact in the preferred embodiment three »q>loitation keys are provided, one set for the 
present month, one set, for the next njonth,-^d one for resun^e purposes in the event 
. of , -system failure. . ... - ^ . ^ . „ , . 

In more detail, the group subscription EMM proper has all of the above components, 
25 except the management ciphering keys j 3:^54 . /The tohot offer subscription 
EMM proper (which is. for an ,mdividual subscrtoe^) inpludes Im^ of the full 
subscribers' group bitmap 3152 the group ID followed by the position in the group, 
and. then management ciphering keys 3154 and three exploitation keys 3156, followed 
by the relevant obsolescence date 3158. J ^ . . , , 



BNSOCJCID: <WO_QB434aeA1_L 



W0 98/43il26' 



PCT/EP97A)il08 



•-21- 

■ • The Messa'ge Generator 3166 serves to transiform commands issued by the STM server 

3104 into EMMs for passing to the Slessage Emitter 3302. With refereiice to Figure 
. 5, firstly,' the MG produces the EMMs proper and passes them to the Ciphering Unit 

3008 for ciphering with respect to the man%ement and exploitation keys: The CU 
5 completes the signature 3064 on the EMM (see' Figiire 3) and passes the EMM back 
' tb the MG, wheife- the hclader 3060 is aaded." The' EMMs vvhich are passed to the 

Message Emitter are thi& compfete EMN^s. Tlie Ntessage Generator =also determines 

■ ■ the broadcast start and stop^time' aiid the rate -of emission of the EMMs/ and piasscs 

these as 'appropriate directions along with the' EMMs to' the Message Emitter. The 
10 MG only generates a 'givtai EMM oiice; it- if' the ME which perforins its cyclic 
transmission. 

..- t . >•- •■•. '.• i: •■ - •■ '•■ • ■ • 

Again with reference to Figbre 5- the'Message Generator ihcludes ^its'^own EMM 
database 3160 which, for the lifetim'e'df ih6 relfevaht EMM, istores -it. It is ^erased once^ 
its emission duration has expired. The database is used to ensure consistency between 
15 - - the MG and !ltE;-So "tKat fb^r^x&pe-wlieh ah^6iia bs^r i§ siisptoded the ME will not; 
cbhtinue to send renewal^. ' fii'tfiis fe^atd flie UG cbmputcS the jrelevail operations 

' and sends them to the M£; ' " ' ' 

.-r ' ■ r/'2 ' 'J '■ L 

On generation of Mi'^fiMMv the "MfG assighs a ninique idratifier to ^the-'EMM.-'-W^ 
" the MG passes the EMM to fiic^vffiy^'ir'also pSsSes 'this: EMM ilX Hiist enables 
20 identification 6f a particuliir EMN^ at bbtK the NtG- aQd=the ME/ 

•v':iL.:r< :;"3 -v.U • . ••V.^.j .. 

Also concerning the Subsbriptidn'-Chain ^ea,' the Message -GenWator includes two 
FIFOs 3162 and 3164, one for each of the relevant Message Emitters 3302 ziid 3304 
in the EMM Injector 3300, for storing the ciphered EMMs. Since the Subscription 
Chaiii area and EKIM ihjectbr^ay W i significant- distance apart,- the-us&'of HFOs 
25 caff allow full continuily^m EMM "trShsinissioa ^sVeri if ^the links 3166- and 3168r 
^ betweeb the tWb fail. Simfe HFCi'^s are provided in the Paiy Per Vieyr Chain area. 

1. * • . *^ • - • -.' 

One particular feature-iof the Message Gerieratdir- in. i)^^^ 

access system in general concerns the way that it reduces the length of the EMM 
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proper 3062 by mixing parameter length and identifier to save space. - This is now 
described with reference? to Figure: 10, which illustrates an exemplaiy .EMM{(in fact 
a PPV EMM, which is the simplest EMM). The reduction in length occurs in the Pid 
(Packet or "Parameter'* identifier):3170; This comprises two portions, the actual ID 
5 3172, and the length parameter for%the packet 3174 (necessary in order.that th^ start 
- of the next packet can be identified). The whole Pid is expressed in just one byte of 
information, 4 bits being reserved for ItherlD,. and four for the length. Because 4 bits 
- is not sufficient to define^ the length in true binary. fashion, a- different coirespbndence 
between the bits and the actual length is used, this correspondence being represented 
10 in a look-up table, stored in storage area 3178 in the Message Generator (sec Figure 
: 5). The correspondence is typically as foilows:.r^ ^ : 



15 



20 



25 



0000 = 
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0001 = 
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0010 ' =t 




0011 = I 




0100 = 
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0101 = 
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0110 = 




0111 = 




1000 = 
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1001 = 
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1010 
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1011 ^■ 


• ■-11' ■" 


1100 = 


12 


1101 ;= 


16 


1110 i= . 


■ . 24.^ 


1111 = 


32 



1\v 



It will be seen- that the length paraineter is not directly proportional to the actual 
length 6f the packet; tfie relationship is in part'more quadra:tic rathenthan linear. This 
30 allows for a greater range of packet length. : 
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Pay Per View. Chain Arean : ^ j • 

' Concerning the Pay Per View Chain arcai. 3200, with reference to Figure 5. in more 
' detail 'the Authorisation Server 3202 has as its client the Order Centralized Server 
3207, which requests information about each subscriber which connects : to the 
5 ' Communications Servers 3022 to purchasci.^a PPV product. ^ ... 

If the subscriber is»known from the AS^3202, a-jsct of ;transactions takes place. If the 
subscriber is authorized for.-the order, the AS CTcatcsj a bill and sends it to the: OCS. 
Otherwise, it signals to the OCS that the order is not authorized. . 

It is only at the end of this set of transactions that; the AS updates, the*: end users 
10 database 3204 via the database servers (DBAS) 3206, if at least one transaction was 
authorized; this optimizes the number of database accesses. . 

The criteria according to which the AS authorizes purchase are^tored in the database, 
accessed through DBAS processes. In one embodiment^ the database is the same.|S;! 
the database accessed by the STM. 

15 Depending on consumer profile, the authorization may be denied 
(PPV_Forbidden,Casino_Forbidden ...)• These kind of . criteria are updated by STM 
3104, on behalf of the SMS 3004. 

Other parameters are checked, such as limits allowed for purchase (either by credit 
card, automatic payment, or number of authorized token purchases per day). 

20 In case of payment with a credit card, the number of the card is checked against a; 
local blacklist stored in the local blacklist database 3205. 

When all the verifications are successful, the AS:- 

1. Generates a bill and sendsiit to the. PCS, which. completes this bill,and stores 
it in a file, this file bemg..later sent to the. SMS for ^processing (custpnaer actual 
25 billing); and : : . 
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2. Updates the database, mainly to set new purchase limits. 
This .check-and-generate-bill-if-pK mechanism applies for each command a 
subscriber may request during a single connection (it is possible to order e.g. 5 movies 
in a single session). 

It is to be noted that the AS has a reduced amount of information concerning the 
subscriber, by compairison with that held by the sjylS. For example, the AS does not 
hold the name or address of the subscriber. On the other hand, the AS does hold the 
smartcard number of the subscriber, the. su.bsCTiber's, consumer category (so that 
different offers can be made to different subsCTibcrs), and various flags which state 
whether, for example, the subscriber may purchase on credit, or he is suspended or his 
smartcard has been stolen.. Use of a reduced amount of information can help to 
reduce the amount of time taken to authorize a particular subscriber request 



The main purpose of the DBASs 3206 is to increase database performance seen from 
the AS, by paralleling the accesses .(sp actu^^^ not make much sense to define 

15 a configuration with only one DBAS). An.AS parameter determines how many 
DBASes should connect. A given DBAS may be connected to only one AS. 

Tlie OCS 2307 mainly deals with PPV conounands. It operates in several modes. 

Firstly, it operates to process commands issued by the SMS, such as product 
refreshment (for instance, if the bill is already stored by the SMS, no bill is generated 
by the OCS), up<tete of the wallet ^^m , 3020, and session 

cancellation/update. . 



Tte various Steps in the proccd^^ 

J^^f.^^ifying the reley^^ 
2. If valid, generate adequate commands tp |he Message Generator, in order to 
25 send an appropriate EMM. Commands may be: . 
.Product conunands. 
Update of the wallet, 
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Session" erasure. 

Note that these opcratioiiis do liot imply creation of billing information, since billing 
is already known from the SMS. These operations are assimilated to "free products" 
purchase. 

5 Secondly, the O'CS deals with commands received from the subscribers through the 

• t • ' .* .... J , • ^. 1- . 

Communications Servers 3022. These may be received either via a modem connected 
, , • ; ■ ; . / :* .i ■ * - * ' • 

to the receiver/decoder 2020, or by voice activation via the telephone 4001, or by key 

activation via a MINTTEL, PRESTEL or hke system where available. 

.:. ■ ... ' .• , ^ :: ' "c « ^ ^- ty ^ .\ ' - 

Thirdly, the OCS deals with callback requests issued by thd SMS. These last two 
10 modes of operation are how discussed in more detail. 

In the, second type of mode described above it was stated that the OCS deals with 
comniarids received ^ di^^^ user '(subscriber) through the 

Cbinmunicatlons Servers 3022. ttese Include iprbduct orders (such as for a particular 
PPV* event), a subscription modification requested by the subscriber, and a reset of a 
15 parental code (a parental code being a code by which parents may restrict the right of 
access to certain programmes or classes of programmes). 



The way in which these commands are dealt with is now described in more detail with 

[ n .1:! : ' 

reference to Figure II. 

Product orders by a subscriber involve the following steps: ^ ' 
20 1. Identifying through the AS the caller who is making a call through the CS 
3022 ordering a particular product; 
2. Checking the caller's request validity, "again using the 'ks (wli'ere the' order is 
placed using the reccivef/aedcKi^^ ^2020,^ this is achieved by verifying the 
smartcard 302ff details); " ^ ' ^» - ^ 
25 3. Ascertain the price of the purchase; 

4. Check that the price does not exceed the calle?s credit limit etc; 

5. Receiving a partial bill from the AS; 
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6. Filling additional fields in the bill to form a completed bill; 

7. Adding the completed bill to a billing inforaiation storage file 3212 for later 
processing; and 

8^ iScnding conrcspondpg command(s) the PPV. Message Generator 3210 to 
generate the relevant EMM(s). 

The EMM(s) is sent either pn the modem line 4002 if the consumer placed the 
product order using the receiver/decoder 2020 (more details of this are described 
later), pr else it is broadcast. The one exception tp tljis is where there is some failure 
of the modem connection (in the case where the consumer places the order using the 
receiver/decoder); in this event the EMM is broadcast over the air. 

A subscription modification requested by a subscriber involves: 

' * - ^ - .. - , ' i ;^ y 'i :r * .J- 

1. Identifying the caller (using the AS);, 

2. Sending information to the Command Interface; the CI in turn forw^ds this 
information to the SMS; and 

15 3. Via the CI, the OCS then receives an answer from the SMS (in terms of the 
cost of the modification, if the modification is possible). 

If modification was requested using the receiver/decoder, the OCS generates a 
confirmation to the SMS. Otherwise, for example in the case of phone or Minitel, the 
subsoiber is prompted for confirmation and this answer sent to the SMS via the OCS 
20 and the CI. 

. Reset of a parental code involves: 

1. Identif/ipg the c^ler (using AS); 2m^^ 

2. Sending a command to the MG to generate an appropriate EMM bearing an 
appropriate reset password. 

25 In the case of reset of parental code, the command to reset the code is for security 
reasons not permitted to originate from the receiver/decoder. Only the SMS, 
telephone and MINITEL or like can originate such a command. Hence in this 
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particular case the EMM(s) are broadcast only on air, never on the telephone line. 

It will be understood from the above examples of different modes of operation of the 
OCS that the user can have direct access to' the SAS, and in particular the OCS and 
AS, in that the Communications Servers are directly connected to the 'SAS, and in 
5 particular the OCS. This important feature is concerned with reducing the time for 
the i^ser to communicate his command to the SAS. 

. - • . . ;■- v.'. - ^ ' : 

' This feature is illustrated further with reference to Figure 12, from which it can be 
seen that the end user's Set-Top-Box, and in particular its receiver/decoder 2020, has 
the capability of communicating directly with the Communications Servers 3022 
10 associated with the SAS 3002. Instead of the connection from the end user to the 
Communications Slervers 3022 of the SAS 3002 being through the SMS 3004 the 
connection is directly to the SAS 3i0b2! 

In fact, as directly mentioned two direct connections are provided. 

The first direct connection is by a Voice link via a telephone 4001 and appropriate 
15 telephone line (and/or by MINITEL or like connection where available) where the end 
users still have to input a series of voice commands or code numbers but time is saved 
compared with the communication being via the SMS 3004. 

The second direct connection is from the receiver/decoder 2020 and the input of data 
is achieved automatically by the end user inserting his own daughter smartcard 3020 
20 thus relieving the end user of the job of having to input the relevant data which in 
turn reduces the time taken and the likelihood of errors in malciiig that input/ 

A further important feature which arises out of the above discussion is concerned with 
reducing the time taken for the resulting EMM to be transmitted to the end user in 
order to initiate viewing by the end user of the selected product. 

25 In broad terms, and with reference to TFiguire 12, the "feature is again achieved by 
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prpviding the end usets rcceiyer/decoder. 2020 with the; capability of communicating 
directly with the Gommunications Servers, 3022 associated with the SAS 3002. 

As described earlier the integrated receiver/decoder 2020 is connected directly to the 
Gommunications Servers 3022 by: the n?odemmed.:^ack channel 4002 so that 
5 V commands from the decoder 2020 are proces§ed,by,the SAS 3002, messages generated 
(including EMMs) and then i5cnt back directly to tlie decoder 2020 through the .back 
channel 4002. A protocol is used in the cpmrnunication between the CS 3022 and the 
r$jceiver/decoder:2020 (as described later), so that the CS receive acknowledgement 
of receipt,. of the relevant EMM,, thereby adding certainty to the procediire. .., 

10 ■ llius, for exaniple, in the case of. apre-book mode the SAS 3JD02 receives messages 
, from the end user via the smairtcard and -decoder 2020 via its modem and . via the 
telephone Ime . 4002^ requesting, access. t.Or- a specific .cvent/prDduct, and returns a 
suitable. EMM .via the . telephone „lifie 4QQ2 and::modem.ato. the deccsder- 2020, the 
modem and decoder being preferably located: together in a SeHTop^Box (STB)., This 

15 is thus achieved without having to transmit the EMM in the MPEG-2 data stream 
.2002 via the multiplexer and -scrambler 2004, the.upUidc 2P12, satellite 2Q14 and 
datalink 2016: to enable the endi,us«: tq viewcthe cyent/prochict. This can save 
considerably on time and bandwidth,- Virtuabcertainty 4s; provided that as sopn as the 
- subscriber has paid for his puichj^e .th© EMM vvill^arrive at the receiver/decoder, 2020. 



20 



In the. third . type: of mode of operation f of Jhe OGS 3207 described above, the OCS 
deals vdth callback requests issuisd by ,the SAS,. This is illustrated with reference to 
Figure 13. Typical . callback requests have the purpose of ensuring that the 
receiver/decoder 2020 calls back the SAS via the^npdenuned back channel .4002 with 
the information that the SAS requires of the receiver /decoder. 



25 . As instructed: by. the. Command Interface 3.1Q2,-the subscription chain Message 
Generator 3106 generates and sends to the receiver/decoder 202 a callback EMM. 
This EMM is ciphered by the Qphering Unit 3008 for security reasons. The EMM 
may contain, the time/date at jyhich .the. receiver/decoder ^puld wake up and perform 
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' ^ callback on its oWn, without bein^ explicitly solicited; the EMM may also typically 
contain the phone numbers iX-hich the temiinab must ^ dial- the- humbcr: of further 
attempts after unsuccessful calls and the delay between two calls. 

When receiving the EMM, or at the specified time-date; the receiv&r/decoder connects 
5 • to the Communications Serveis'3022. The OCS 3207 first identifies the caller, using 
> 'the AS 3202, an& verifies ceSrtaih details-, sucli as smartcard operator and siibsaiber 

• det^is." Tlie OCS -then asks the sniartcaid 3020 t;o sehd various fcipfiered information 
(such as the reltevaht session numbers, when thfeTsfessicm was waitched, how mafiy times 
the subscriber is allowed 'to '^'iejw tW session- agam^tiie way in which the session was 

10 viewed, the number of remaining tokens, the number of prebooked sessions, etc). This 
information- is dfedpliered by the PPV thaSnlMessage Generator 3210, lagaln using the 

• Ciphering Unit 3008-: ' The OCS adds this^^information to a? callback information 

• storage file 3214 forlater pfeki^sing and'f)a&Sii^:tO the SMS03004i -The iriformation. 
■ is ciphefM ifor 'seetiri^ -r^'asdiis? Ithe Whole prbpisdiire is ^Tfipeated- unti^ 

15 nothing more to be tcM-iEfona '^hfe^skfiastcairdi'-^ '3 ^ • - - - - * 



One partidilar prcfeflted' feature^bf ^hg icanback fe^^^ thatibefore reading thg 
sinartcaid (so jiast after the identification thfe^caller using, the AS 3202 as describe^. . 
above) a check is made by the SAS 30CK2 that the receiver/decoder is indeed a genuine., 
" -one rathbr than a ^irafed version' 6!r cdfiaiStiter siBSulatioh. 'Such a check is carried out 
20 in the following manner. The SAS generates a random number, which is received by 
the receiver/decod&f, dphered; and" then'retiirned to the SAS. The SAS deciphers this^^'. 
number. If the dcciphefing is stfcc^&l arid the original random number is retrieved, 
it is concluded that thfe reebivei'/decdder is genuine, and the procedure continues. 
-Otherwise, the piroJedaure ifr^disicont ^ * ' ' ^-^ ' 

. ..■ i-/tc-;-: -.ii if '■=>.'• t v. : ..- • ' • .• • . -.. r --. • .: 
25 Other functions which may occur during the callback are erasure of obsolete sessions 
on the smartcard, or fiUiiig.of the waft'et Ohiisi latter also being described, later under 
' the sfcction entitled "Smartcztfd"-). ' • - -• 



• Also" as regards the Pay Per View -Chain area- 3200,: description' is now made of the 
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. : Communications Servers 3022,, • At the hardware level, these comprise in. the preferred 
embodiment a DEC Four parallel processor machine, ,At Jhe software architecture 
level, with reference to Figure 14, in many respects the Communications Servers are 
, , conventional. ;Onc particular divergence from conventional designs arises from the 
5 , . fact that the Servers must serve both recciver/dccoders 2020 and voice corimiunication 
^ . with conventional telephones. 4,001„as.wfell .possibly as MINITEL pr like gystcms. 

It will be noted in passmg that two Order Centralized Servers 3207 are shown in 
Figure 14 (as '^OCSl" and "OCS2':). :Naturally any desired ijumber may be prpvided. 

Tht Communication Servj?rs mclude two m^un seryprs ("CSl'';and "CS2") as well as 
10 J a number of frontal servers.("Frpntal4V and "Frontal 2"); whilst two frontal servers 
. .-. ., are shown in the figure, typically 10 or 12 may be provided per main server. Indeed, 

although. two main servers GSlfand GS2,.an{J two frontal, servers, Fronjt^l 1 and Frontal 
- . . .. 2, haye been, shown, any. number. oDiu^ld, .be -used,, .^^ is usually 

-desirable. • • .; , , ..j, . ..^ . . .; 

15 CSl and CS2 are coupled to OCSl and OCS2 via high level TCP/IP links 3230, 
whilst CSl and C^2 :are coupled, to Frontal 1 and F;ront^ 2 yia,further TCP/IP Imks 

■ . =3232.- - . .-, . ;v -.J \, ., 

As Ulustrated, CSl aiidCS2 comprise siayers fpr"SH^R" (transmission), ^'RECVR" 
(reception), "VrX" (MINTmi^ ,I?iUESTEL , ; or ; the like),- "VOX" (voice 
20 coDMnunication), and "TRM" (communication with the receiver/decoder). These are 
■ coupled to the "BUS" for communication of sisals to :the Frontal servers.. 

CSl .and .CS2 communicate directly with , the receivor/decoders 2020^ via their 
modemmed back channels 4002 using the public network commo The 
relatively low-level pn:>tocol between the Communications .Servers 3022, and the 
.25 • : -icceiver/dec.oders 3020 is in one^preferred embodime^tt basjsd upoii the -V42-standard 
international CCITT protocol,- which provide;;, reliability, by having error detection and 
data re-transmission facilities, and uses a checksum routine to check the integrity of 
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- the it-trahsmission/ ' escape iiicchahism is also provided in order to prevent the 
transmission Of disallowed characters. " ' . • • . • 

'' On the other hand/ voice telephone comriiuhieatiori is carried out via the Frontal 
Gk)ihihunications Servers, each capable of i^icking up, say, 30 simultaneous voice 
5 connections from the connection' 3234 to- the local telephone network via the high 
speed (El) standard telephony ISDN lines, 
r r ■ . • ' ' ■ " ' ' • • 

^ Thrfc^ particular fiinctioris of the- is6ftware portion of the Communications Servers 
(which could of course alternatively be implemented fully in hardware) are firstly to 
convert the relkively Ibv^-^ level "f)rotodol information -received from the 
10 receiver/decoder into the relatively higlii level protocol informatioh output to the OGS, 
- ' secondly tb attenuate or control the number of simultaneous connections being made, 
' and thirdly to'provide severM slrfiuitahe<His ehanhels without any ftiiJiing. W this last 

- tegardi-the^GonimtinicSatioiis'Serv the^'fOle- of af fOfin of multiplexer, with the ^ 
interactions in a particular channel being defined by a given Session ID (identifier), 

15 which is in fact used throughout the conmiunication chain. 

Finally as regztfds the Pay 'Per View Gham' area. 3200, and wdth> reference ajgain to ..^ . 
Figure 5, the Server for Programme Broadcast (SPB) 3208 is coupled to one or more 
Programme Broadcasters 3250 (which would typically be located remotely from the 
SAS) to-'receive programnie 'infomati SPB filteJs out *for further use 

20 information corresponding^^ to PPV eVeht ^ " ' 

A iiarticulariy important feature is that Ihe filtered pTogranlirie event iiifprmation is 
passed by the SPB to the MG which in turn sends a directive (control command) to 
the ME to change the fate of cyeHc' emission of the^EMMs in given circumstances; 
this is done by the ME finding- a^i 'l^Ms wih th6 relevant session identifier and 
'25 ' changing the cycle rate allocated to sudi EMMsi This feature might be thought of as 
a dynamic allocation of baidwidth- for '^cffic EMMs. Cyclic^ EMM emission is 
discussed in liiore detail in the" section below concemied with the -EMM" Injector. 
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The circumstances in which the cycle -rate is changed are now de§cpbed with reference 
,t6 Figure 15, whichi dexrionstratcs how cyqle rate 3252 is raiscfd a short while (say 10 
minutes) before a particular PPV programme event until the end of the event from a 
slow cycle rate of say once every 30 minutes to a fast cycle rate of say once every 30 
5 seconds to 1 minute in order to meet, the anticipated extra user demand for PPV events 
at those times. In this way bandwidth can be allocated dynamically according to the 
anticipated user demand. This assist in jeduicing the- overall bandwidth 
requirement,- . 

The cycle rate of other EMMs may also be varied. For example the cycle rate of 
.10 subscription EMMs may be varied by the Multiplexer ancj ^Scrambler 2004'scnding the 
appropriate bitiate directive. . . : 

. EMM Inlector 

> Conc?^rning. the EMM. Injector 330p> dpta^ils^^pf ,th^ Message , Eini^ters 3302 . to 3308, 
. forming p^ of the EMM fojector and gq<i^^^^ for the Message 

15. ; Generator,, are iiow described with reference to Figure 1^, Th^ir, function is take the 
r EMMs and to pass them cycliqally (in the manner of ai carousel) via respective links 
3314 and 3316 to, the Software Multiplexers 3310 and 3312 and thence to the 
hardware multiplexers and scramblers 2004. In return the software multiplexers and 
scramblers 2004 generate :a globtal bitj^te diieetiye to control the .oyerall cycling rate 
20 of the. EMMs; to dO; so, the MEs take into account various parameters such as the 
cycle time,. the size of EMM,, and. so. on. ^Jfa the figure„EMM_X and EMM _Y are 

group EMMs for operators X and Y, whilst EMM Z are other EMMs for either 

• ... ... 

operator X or operator Y. 

Further description proceeds for an C3^emplai:y one of the Message Ejmitters; it will be 
25 . appreciated that the remaining MEs operate in , -similar iasjiion. ^^ The ME operates 
. ; under control of directives from the MG, most notably transmission start and stop time 
. . and emission rate, as well as session number if th^ EMM is a PP V EMM. In relation 
to the emission rate, in the preferred embodmcnt the releyant directive may take one 
of five values froni Very fa§t to Very ^slow. , ITie numeric values are not specified in 
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tlic'ditectivc, but^iratHcr tiic'ME maps the directive to an actual nunieric value which 
IS supplied by thfe relevant part of the S AS. lif the preferred embodmient, the 5 

. i •■; .. ' • . , 

emission rates' are aS foUov^s:- 

r'' . . • 'u, ■ : :w ; ^ , - ' ; • v 



1. 


Very fast 


every 30 seconds 


2: 


Fast 


'- every minute 


y: 


Medium 


'-'^evdry IStainutes 


4. 


Slow 


- every 30 minutes 


5. 


Very slow 


- every 30 minutes 



The ME Itxas fiist and sebond databkses 3320 and'3322. The first databiase is for those 
10 EMMs which have not yet achieved their broadcast date; these are stored* in a series 
of chronological files in the database. The second database is for EMMs for 
immediate broadcast. In the event of a system crash, the ME is arranged tOf have ihth^ 
ability to ^e-rekd* th^ Irel^varit' Stored tiie arid pcrfbmi ciorrSct broatdca^t ; AH the file^^ 
"''-^ Stored in the datitbases^are ufidated lipdn request from the MG, when the MG wishesfe^ 
15 ^* to maintain consiistency bctWeeri incoming ' direttivbs iand EMMs- already sent to the^^ 
" MEf The EMMS' actually being broadest are also stored in Randoin Access Memo^^^ 
'"3324. ' ■ • - ' " • ' ■ ' - 

"' A combination of the FIFO^ 3162 aiid 3164 in the' Message Seiietator and the 
database^ 3320 and 3322 in4tie Mdssage' Emitter means that the two can operate in 
20 standalone mode if'^the link 3rf66 H>etw'eenHhem 'is temporarily broken; the-ME can 
still broadcast EMMs. -^'^ ? ;(vi ^ i ^; C ii^^r-.: 

The Software Multiplexers (SMUX) 3310 and 3312 provide an interface between the 
MEs and the hardware multipl)53{drs 2004^ In the' preferred embodiment, they each 
receive EMMs froin two 'of the MBsr; altlioiigh m 'general there is no^restriction on the - 
25 number of MEs that can be ^im^«ed with onfe SMUX. The SMUXs cbnecnttate the 
EMMs and then paKs 'them'accordmg' to the type of EMM to the appropriate hardware 
multiplexer. This is necessary Ib'ecau^e the hiardwai^e raultiple:^crs take thd different 
types of EMMs ^d place them at -different places in the MPEG-2 strfcam. The 
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, .SMUX's alsp forward global bitratc dirccjtives from, the hardware multiplexers to the 

One particularly unportant feature of the ME is that it emits EMMs in random order. 
The reason for this is as,follo\ys. The Message Emitter has i^p ability, Jo sense or 
control >yhat. it einits to the multiplexer. Hence it is possible .that , it may transmit two 
gMMs which are t(0 be^ received ^d; depoded by rthe^receiver/decrodcr 2P20^back to 
back. In such circumstances, further, it is possible that if the EMMs are insufficiently 
separated the receiver/decoder and smartcard will be unable to sense and decode 
properly tlje second of the. EMMs. Cyclically emitting the , EMMs in random order 
can solve this ^problern. ^ : , , ■ . . ^ ^ 

The manner in winch Tandoniizatioii is achieved Js now. described with reference to 
^ Figure^l?; in th^ prefei^rpd embodiment tb^e neccssa^ software logic is implemented 

, in the? APA CQinputer language. A particjularLy im^ |)art of the^andomization 
if the corrcQt storage o^ the E^(IMs ip t^ d^|abaseSj. 3320, and 3322. (which are used 
fox backijp purposes) an^-in the RAM 3324. JFor a^paiticular cycje rate and operator, 

' thp EMMs,^arc . stored in a two-dimensional array, Iby rank 3330 (going say, from A to 
Z). and nu:Bibcr in the rank 3332 (going from O^to N). A third dimension is addled by 
^ cycle rate 3334, that there aren as many twprdiinensipnal arrays as there ^are cycle 
rates. In t|ic prcfenjcd embodiment .^^^^ andctypicalLy 200 or 300 

EMMs in each rank; there are 5 cycle rates. A final dimension to the array is added 
by the presence of different operators; there are as many three-dimensional arrays as 
there arc operator?. Stora^ in this fashion , can permit rapid retrieyal in 

the event tha^ the . 

Storage of the EMMs takes place according to the "hash'' algorithm (otherwise known 
.^^9°?"Way fonctipn'!., This operates on, a modulo approach, so that 
successive ranks are filled before^ a higher number in the rank is used, and the number 
of EMMs in each rank ipijiainsf roughly constant. . The example is considered of there 
being 256 ranks. When the MG sends the ME an EMM with identifer (ID) 1, the 
rank "1" is assigned to this EMM, and it take^ the first number 3332 in the rank 3330. 
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• " The' EMM with ID 216 assjignecl the litik "2", and sb oil, up to the rank 256. The 
EMM with ID 257 is assigned the rank "1" again (based on the modulo function), and 
takes the second number in the first rank, and so on. 

Retrie^fal of a specific EMM/fdf example when deletion bf a specific EMM is 
5 requested by the MG, is effected by means Of the inverse of the above. The hash 
algorithm is a|>|)Iied tb the EMM ID' tb^bbtkin the rank/after which the' number in the 
raxik is found. ' . . - . . c . . • - 

' ' The actiial raYAJomizaitton OCCURS whwi* the EMMs are, otf a cyclical basis, retrieved 
from RAM 3324 using the randomization means 3340 which is implemchted in the 

10 hardware and/or software of the Message Emitter. The retrieval is random, and again 
based on the hash algorithm. ^^irStly; fandornf' number (in'the aboVe exaiiiple i&tially 
iri Ihb ran^e 1^'to ^56) ijsr'bhoscnVio Vteld the partidtiiai^^ rank 6^ idteriest. Sfecdildly, a? 
furihcir ranidom hiimfecris'cTfdsei^ ptiticular iilmbef'ln tl?e rank.^^The<^ 

fiirther duldom nunifeWfeWedifed^^^ to the tdtel numi)te¥'6f ^MjJls in a given^ 

15 rank.' Onci a given !BMM has been sClectea'and bWadc^ fo a s^econd 

identical storage area in^the -RAM 'SsS^i, aga^ fimction. Heilce the - 

first area diminishes iil Size as" the EmnIs are' broadcast, tb' the extetft that, diice a'^ 
complete rank has been uk^id, Ms ilS dycte<^^ Oiice the first storage area is completely 
empty, it is replaced by the secolid ^slorifee' afea beJfoife 'a^^^^ of EMM 

20 broadcast, and vice versa. ' - 

In the above fashion, after two or ihxth fcycles^ of the EMMs, statistically the chances 
of any two EMMs destiflted^fofthfe saime end^ser bemg frainsmitted'back to biack is 
negligible. 

At itgular intervals 'whilst the-ENliyfe arc being stored the computer 3050 computes 
25 the number of bytes in storage^ and firom this computes the bitrate of eiiussid^ given 
tiie global bitrate directive from 'the multiplexer and sbftwaire multiplexer. 

Reference was made above to the backup databases 332b and 3322. These aire in fact 
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in the preferred embodiment sequential file ^stores, which hold a backup version of 
what is in the RAM 3324. In the event of failure of the Message Emitter and 
subsequent restart, or more generally whiep the. ME is being, restarted for whatever 
reason, a link is made between the RAM and the databases, over which the stored 
5 EMMs are uploaded to RAM. Irj.this way,,the risk of losing.EMMs i|i the.eyent of 
failure pan be removed. 

Similar storage of ^PPV EMlyls -oqcuk. to that described above in relation to 
subscription EMMs, with the rank typically corresponding to a given operator and the 
number in the rank conesponding to the session number. . , : 

10 Smartcard 

A daughter, or "subscriber", smartcard, 3020 is schiematic^y shown in:JFigure 18 and 
comprises an 8 bit microprocessor 110, such as a Motorola 6805 microprocessor, 
- liavmg an input^putput bus to^.sta|idaT4,array,of.<»nta 120 which m use 

arcs connected tp a corrt^sponding.^^y , Of_. cp^ of the 

. 2020, the ,c^^ reader Jbeing : of, conventional design. The 
microprocessor 110 is also proyided with bus connections to preferably masked ROM^ 
130, RAM 14D and .EHPROM 15,0. ITjc snjiMtcard complies with the ISO 7816-1, 
7816-2 and 7816-3 standard protocols which determine certain physical parameters 
of the smartcard, the p9|sitiomi of the contacts on Jthe chip and ccrtain.communications 
20 between, the extern^ system (and p^ioilarly the receiver/decoder 2020) and the 
~ smartcard respectively ^d ^bj^ will therefore not be further described here. One 
fiinction of th? ^ic^oprf^iessor. HQ is.to..mapage the memory in the smartcard, as now 
d|escribed. . . , . 

The EEPROM 150 contains certain dynamically-created operator zones 154, 155, 156 
25 and dynamically-created data ;zones wl^ch ^yill- now described with reference to 

. .Figure 19.. r .; : 

Referring Fjgure .1?, I^PROM, 150 comprises a , permanent "card ID" (or 

manyfacturer) zope 1^1 of .8bytes.wWiC^^ 
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identifier Set by the mahufactlirer of the smartcard 3020. 

When the smartcard is reset, the micfoprocesisor 110 issues a isignal to 
icceivei/decoder 2020, the sigrial bonijjnsiilg an idehUfier of the conditional access 
system* used by t!he smartcard and' d^ta genc^rated fifom data'stored in the smartcard, 
5 including the card ID. This signal is stored by the receiver/decoder 2020, which 
subsequently utilises the stored signal to check whether the smartcard is compatible 
with'thc' conditioned access system used by th^ 

. r . - , : :\i > : ■ • 

The EEPROM 150 also contdiiis a jiermahent "random number generator" zone 152 
which contains a program for generating pseudo-random numbers. Such random 
10 numbers are used for diversifying transaction output signals generated by the 
smartcard 3020 and sent back to the 

' iBclow the iraridoin number gfenerafor'zOne 152 a peririaiient "managemenr^ zone 15f - 
of 144 bytes is provided. TTic perriranie^^ 153 is a' specific operatcl' 

zone Utilised' by pibgraih in the ROlvriSO in the dynamic creation (arid removal) of ' 
15 zones 154, 155, 156... "^ desdribed^ below. The penn^^ 153- 
contaiiis data relating 'to the righti^ 'of tfie -smartcard to create of reniove zonesi 

The Tprogram for dyni^nically bl^fikg^M^^ specific 
zone creation (or removal) EMMs which aire* transiiiitted by tJie SAS 3002 and ' 
received by the receivcr/ciedo'clcf 2020 and pa&ed to4he strt^scfiber smartcard 3020. 
20 In order to create the BMMs the bp6rator requires specific keys dedicated to the 
management zone. This prevents one operator fi'om deleting zones relating to another 
operator. 

Below the manageihferir zone 153' ^'series of "Operator ID" zones 154, 155, 156 for 

operators 1, 2 N respectively. Normally at least one operator ID "zone will be 

25 preloaded into the EEPROM of the subscriber smartcard 3020 so that the end user can 
decrypt programmes broadcast b*y' that operator! However further operator ED zones 
can subsequently be dynamically created using the managexnent'zone '153 in response 
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to a .transaction output signal , generated via his. smatcaid 302Q by the end user 
.;. (subscriber), ras MU sul^equentiy 1» described. 

Each operator zone 154, 155, 156 contains the identifier of the group to which the 
-smartcard 3020 belongs, and the position of the smartcard within the group. ifEhisidata 
5 enables the smartcard (along with the other, smartcards in its-;gioUp) to be responsive 
to a broadcast "group" subscription EMM having that group's address (but Hot the 
smartcard's position iii the group) as well as to an "individual" (or commercial offers 
subscription) EMM addressed ;only to that smartcard within th? group. There .can be 
256 member smartcards of each such group and this feature therefore reduces 
10 sijgnificahtiy the bMdwidth required &r broadcasting ,EMMs.r 

In order to reduce further the bandwidth required for broadcastmg "group" subscription 
EMMs, the group data in each operator zone 154, 155, 156 and all similar zones in 
the EEPROM of smartcard r3020. and the;; other dau^^ continually 
updated to enable a particular smartcard to change its position in each group , to fill 
15 any holes created by e.g. deletion of a member of the group. The holes are filled by 
the SAS 3002 as in therSTM server 3104 there iis a list of 

^'i - .; : •.. . . . .,■ , , . 

^ ' In this manner fragmentation is reduded' and each group's membership is maintained 
at or near the maxinmm of 256 memb^. V : \ . 

Each operator zone 154, 155, 156 is associated with one or more "operator data 
20 objects".stored in the EEPRCBl 150. As shown in^ Figure 19, a series of dynamically 
- created "operator data" objects 157-165 are located below the^ operator ID zones._ 
Each of these objects is labelled with: . , -jr.. 
. a) an "identifier" 1, 2, 3 N corresponding to its associated operator I; 2, 3 ... 
N aS'Shown in its left hand section iaFigUre 19; . - /r- 
25 b) an "ID." indicating the type of object;. andLr . j .' . i -, , . 

• c):^ .a '.'data" zone reserved fpr.data,-'as shown'in the right hand section of each, 
relevant operator object m Figure 19. It should be understood that each operator is 
associated with a similar set of data objects so that the following description of the 
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types of data in the datd "objects 6f operator I'is also applicable to th&data objects of 
all the other operators Also it will be. noted that the 'data objects - are located in 
contiguous physical regions of the EEPROM and that their order is immaterial. 

...... ♦ ■ • . • * ; * ' ' . . ' ■ ' 

Deletion of a data object creates a "hole" 166 in the smartcard, that is] the number of , 
5 bytes that the deleted objects had previously occupied are hot immediately occupied. 
The thus Vfireed" number of bytes, or^ ''hole" arc labeUed with: • - 
a) - ari '^identifier'! 0; and -'^ ' : ^ . u . . : ::.r 

y- b) an "ID" indicating that the bytes are? freeno receive an 6bjcct. : ' 

The next data object created fills the hol^ fas identified by *e identifier 0. In this 
10 manner the limited memory capacity (4 kilobytes) of the EEPROM 150 is efficiently 
■ ■ utilised. * .;. i' r ur)::\ M- wt ? s. - rj^t, ^ i-* • 

. ' ; . :Ci .-^ -'^i^ ':X'i- ' ^2 - -''"^ ' 3- 

Turning now^ to the set of ^data objfects^ assaociatea :'vvdfh each opdratoc,^3fexampl^ 
data objects arc now de^cribed:.^ - ; : ;;n i :j . ^ : / ^ 

Data object 157 contains an EMM key €or dce^pting encrypted EMMls received 
15 by the receiver/decoder 2020. This EMM key is permanently stored in the data object 
157. This data object 157 may be CTcatfed prior to distributiqai of the smartcard .3020j 
and/or may be created dynamically when, creating a jaew operator zdnc (aSTdcscribed 
above). 

. :• • ..:-w '}•; - :C' ■ x-,:" 

Data object 159 contains ECM keys which am serif by the assodated operator (in this 

20 case operator 1) to efiable ^thb end user td.deciypt Uie particiuIarV^bouquet" of programs 
to which he has subscribed. New ECM keys arfe sent typically every month, along 
withca group subscription (renewal) EMM which renews the end user's overall right 
to view the broadcast fi6m:!(int this case) operator 1.* The use of separate EMM and 
ECM keys enables viewing- frights to be^ purchawd ini different: .ways (in this: 

25 embodiment by subscription and individually (Pay Per View)) and also increases 
security;- The Pay Per View (EPV) mode will- be described subsequently. 
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Since new EGM keys are.sent periodically, it :is essential tO:pi:event a user from usin 
old ECM keys, for example by switching off Jhe receivjer/deicodcr or ,re-settingca clock 
to prevent expiry of an old ECM key so that a timer in the receiver/decoder 2020 
could be overridden. Accordingly operator zone 154 comprises an area (typically 
5 having a size of 2 bytes) containing obsolescence^ date of the ECM keys^ The 
nsmartcard 3020. is arranged to c(Mpip^e-this date with the ^current date which is 
contained in received ECMs, and to prevent decryption if the current date is later than 
- the obsolescence date. The obsolescejuce d^te is transmitted via EMMs,; as described 

• above. * ..." . -■ ) • . ... - 

10 Data object 161 .contains a 64 bit subscription bitjnap which is an exact representation 
of the broadcast operator's programs to which the subscriber has subscribed^ Every bit 
represents a program and is set.to "I'^if it is subscribed to and "0". if. it is not. 

• Data object 163. contains a quantity of tokpn3!wln.ch:;can^ b^ used by the consumer in 
V PEV mode to buy vievmig rights to; an iniminentferpadc^ e.g. in response tO; a free 

IS preview or other advertisement^ r Data object 163 also contains a limit . value, which 
may be set to e.g. a negative value to allow credit to the consumer. Tokens can be 
purchased e.g. by :crcdit and via the rnodemmed bac^ channel 4002, or by using a 
. voice server in combination with a credit card, .f^^ e::!^ample. A particular event can 
be charged as one token or a iiumbertpfjc^eis. 

20: - Data object 165 contains a. description of a PPV cyent, as shovra with reference to 
table 167 of Figure 20;; : :i v ^ ...r r :. - ^'^ 

The PPV event description 167 contains a "session ID" 168 identifying the viewing 
session (corresponding to the programr and the tim of . broadcasting) a 

: "session mode!M69. indicating how the viewing, right is^being pinrchascd (e.g. in pre- 
25 book mode), a "session index" 170 and a "session, view" 171. 

In respect of receiving a programme, . in : PPYi ciodQ, the receiver decoder 2020 
determines whether the^prdgramme is one. sold in PPV mode.. If so, the decoder 2020 
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■ • checks; tfsing the items stored in the PPV eveiit desGription 167 whether the session 
• ID.for the pr^gfamriie is stored therein, the session ID is Stored thercip/the control 
word is extracted from the ECM. • ' . •- ' T 

If the session ID is not' stSred therein, tyi means ^of a sjpecific application the 
5 - ie^iVei/decoder 2020 diisplays a messiage to the end use* Indicating that he has the 
• right' la view the ses^idii at a cost of, say," 25 tokens, as read from the: ECM or to 
conneet to the^mihunicationS servers 3022 to pittchase the event.-'-Using the tokens, 
if the end user answers "yes" (by means of remote controller 2026 (sec Figure 2)) the 
decoder 2020 sends the ECM to the smartcaid, thi> smartcard deareases the wallet of 
10 ■ ^ th6 smattcard 3020 by 25 tokens, writes flie scssion-ID 168, the session mode 169, the 
. session indeJc 170 and ^the session viiw 171 in the PPVeevent description 167 and 
extracts arid deciphers the control Wold' froih-thfe-EGMiT. : - • ' ^• 

' In the "pre-book" labdej 'an EMM will' fee passed to the :smartcaKl-3C^D so that the^ 
- smartcard will write thefcsessioiS ID 168, the session mode I69,y the session Index 170^ 
15 and the session view 171 in the'PPV: event' description 167 using the EMM. 'A;-< 
I ■ . .. . i • .;: ;r • ■!■ : -.• ■ y ' -.7 r .. - ' . ■ ■ •■ 

The sesaon index 170 can be set to differentiate one broadcast from the others Thi||^ 
' feature permits authdrizatton to be -)given a subset af broadcasts,' for examplei-% „ 
times out of 5 broadcasts. As soon a^'.an?ECM with a session index.di£Eerent from 
the current session index 170 stored in the PP'V event description 167 is passed to the 
20 smartcard, the numberof the session view 171 is decreased: by one. When the session 
view reaches zero, the smartcard will refuse to deciphcir an;ECM with a different 
session index to the current session index. 

V ' Hie initial value of the session vieW^depends only^ on the way in which the broadcast 
supplier wishes to define the ! cSvCiit to which, it relates; the .session view for a 
25 respective event may take a&y= value; ■ . c' 

- • The microprocessor 110 in the smartcard implements a counting and a coinparison 
" program to detect when the limit to the number, of viewings of a particular .program 



BNSocx^o: <vyo_9e434aaAij_> 



wo 98/43426 



PCT/EP97/02108 



... -.42- 

has been reached. , , 

All of the session ID 168, the scssiqn mode 169, the ^ssion index 170 and the session 
view 171 in the PPV event description 167 may be extracted from the smartcaid using 
tlje "callback" procedure as, described prc^^^ . . . , 

Each receiver/decoder 20;20 contains, an Jdcntj^^^^ which may either identify uniquely 
that receiver/deccKicr or identify its manufacturer or may classify it in some other .yv^ay 
in order to enable it to work only with a particular individual smartcard, a particular 
.plass of si^artcards made by the same qx; a .corresponding manufacturer pr any other 
class of sma^cards which are .intended for use with -that class, of recelyer/decpders 
^exclusively. . - ^ . ^ ; - , , , 

In this maijncr the rcceiyer/dccpde^^^ 2Q20 which have been supplied by one broadcast 
supplier to the comumer. are projected. against daughter 
. smartcards 3020.. . . ^ . ... 

Additionally or alternatively to this first "handshake" between thj? smartcard and the 
receiver, the EEPROM of the smartcard 3020 could contain a field or bitm^ 
describing the categories of receiver/deradere 202p with which it can function. These 
could be specified cither dxiring th^-^msmufac^r^-,^ or by a 

•specific, EMM... - .... , . 

Hie bitmap stored in the smartcard 3020, typically, comprises a list of up to 80 
receiver/decoders, each identified with ,a,coCTesponding.recejLyer/decoder ID with which 
the smartcard may be used. Associated with each re^cciyer/decoder is a level "1" or 
"0" indicating whether the smartcard may be used with the receiver/decoder or not, 
respectively. A prpgra^l in the memory 2024;Of tjhe. jeceiyer/decoder searche^j for the 
identifier of the receiver/depoder.in^the^ ^tored in: the smartcard. If the 

identifier is found, and the value associated with the identifier is "1", then the 
smartcard is "enabled!*; .if; not, then the.,smautQard .will not function with that 
neceiver/decpden 
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In addition, if, typically because of an agreement between operators, it is desired to 
authorize the use of other smartcards in a particular receiver/decoder, specific EMMs 
' Svili lie sent to those smartdafds to change their bitmap'via the transponder 2014. 

Each broadcast supplier may diffefeiiSate^ his subscribers according to certain 
5 predetermined criteria. For example, a number of subscribers may be classed as 
/ k ttyjpgM A<xordingly; Mch broadcas^-supplicr m^ dividie his subscribers into a 
' plurality of subsets, each subset' comprising any number ot subsoribers. ^ 

The subset to whicit a partfcular subscriber belong is set in the SMS 3604. In turn, 
the SAS 3002 tran^xSits an EMM to the subsSribcr wliich writes' infotoation (typically 
10 of length 1 byte) concerning the subset to which the subsCTiber belongs into the 
relevant operator data zone, say 154, of the EEPROM of the smartcard. In turn, as 
' events are ^broadcasf by the broadcast supplier,- 'an ECW, typically of 2*56 bits, # 
traj&mitted with the Wktirs^^ of subiscribers may vie^^^ 

the. event. If, according to the information stored in the operator zone, the stib^cribct 
15 does not have the right to view the event, as determined by the ECM, programme 
* view^ing is denfed. ' ^ ' * ' - 

This facility may be^ iisied, for examipfc; -to^ switch off air of a givsen operators 
smartcards in a pafticular geographical regitoii during^ the transmission of a particular 
program, in particular a program relatmg to a sports fixture taking place in that 
20 geographical region. In this manner football clubs and other sport bodies can sell 
broadcasting ri^ts outside tbcir^ locality -^Kilst pt^^ supporters from 

viewing the fixfttfe xJri televisfdnr^'ln -tlire'inabner the Ibcaf stipporters are encouraged 
to buy tickets and attend the fixture. ' ^ - : . . - . 

Each of the features assTOcfatfed A^thr zones 151 to f 72- is considered to be a separate 
25 invefition indepcndeht of Ihe aynainic^ : 

' ' It will be understood -thai tKe present invention has -beeii described above puirely by 
way of example, and modifications of detail can be made within the scope of the 
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invention. , t 

Each feature disclosed in the dcseription, and ^(whcTe appropriate) the claims and 
drawings may be provided indcpendemly oi in apy appropriate combination, 

: In the aforementioned preferred embodiments, , certain features of the present invention 
5 have been implemented using computer software:, However^ it will of course Jbe clear 
to the skilled man that any of these features may be implemented using hardware. 
.Furthermore, it will be rea^fly/ understood that /the .f^^ by the 

: hardware, th? computer^ spftvyare^ said sueh like arlb performed qn or using electrical 
t:. and like signals. . > ,>r . : , , .» - 

10 Cross reference is made to our co-pending applications, all bearing the same iSling 
date, and entitled Signal . Generation and ^^^ B^ no. 
: /Fe/ASB/19707); Smartcabrd for u?e:witli f^Re.qeivej: qf Enc^ Signals, 
and Receiver <Atto^ley .Refe^ence^No. -EG/ASB/19708),) Broadcast ;ahd Reception 
System and Conditional Access System therefor (Attorney Reference No. 
15 : PC/ASB/1973:0), .Downloading f ^GomputK File ; from, a ; Transmitter via a 
Receiver/Decoder , to a Computer - (Attorney:. : Reference No.- . PC/ASBA9711), 
Transmission and Reception of Television Programmes and Other Data (Attorney 
Reference No. PC/ASB/19712), Downloading Data (Attomey Reference No. 
: PC/ASB/19713), Qornputer ;.Mcmdiy i Organis^^ (Attorney Reference No. 
20 PC/ASB/19714), Television or Radio Control System Development .^Attorney 
Reference No. PC/ASB/19715), Extracting Data Sections from ^ a Transmitted Data 
Stream (Attomey Rcference.No. PC/ASB/19716),.:Access^^ Control System (Attomey 
Reference No. PC/ASB/19717), Data Processing System (Attomey .Reference No. 
PC/ASB/19718), arid Broadcast , and jReception System, and Receiver/Decoder and 
25 Remote Controller therefor (Attomey Reference No. PC/ASB/19720)v Hie disclosures 
of these documents are incorporated herein by reference. The list of applications 
: ^includes the present application, i V r; -? . : vr-v:. 

■ *■ ' '1 " ■ "tvr'VT • .. .... ■ v' ;■ • 
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CLAIMS 



1. A (X)nditional accc^ system comprisin^^ - • 

/ means for generating a plurality bf messages; and - i ' ^ 

riieans for receiving the messages, said receiving means being adapted to 
5 '"* ' - communicate with said genetating' meajiS '^via' a vcomnlunicatiohS* serv^^ 
*: directly to said^ generating means. • 



2/ A conditional access system accofdihg to Claim 1, whiiercin said message is an 
entitlejnent message for transmission lo-fhefTecciving mean's, said generating mbans 
being adapted to generate entitlement messages in response to data receivecl'frdm said 
10 receiving means. 

' 3. * /lA conditiOnarac?:ess^ysterta^acoord^^^ 1 ot 2, wherein saidgcnfefating 

means is arranged to transmit ^a me^^el^S' a packet 'of -digital dat^ tb said teceiving 
means 'either s^via said cbxtimufiicati6nslser\^^ or tvia a'latjellite- tfanspGfnderv ' ^ 

•4. ' A conditional access system according to- any preceding, claimi' whcrc^^ 
15 receiving ineans- is donnectable to said ^communications server via a modem an^ 
'telephone link/^>' - i.: * '••^^-^'^ . -i -.''"' ? •*';*;: ' - .,i : ,r :r. \-:V i 

S: A conditional access^ system* for ^fording conditional access' to ^subscribers, 
^ comprising: ' " -"^'^Z "- .^^1 - /;v .":^vT .^'^^ ./ 

» I : a subscriber management systemy^ - i , : T T * ; ^> . ' : v. 
20 a subscriber ' authorization ^^ysteiri coupled , to the: subscriber ; management 

system; and ■ nv-: :r:^:K-..* r^r' • : .'-^ : " •« -../■.::^S:-' 

a communications server, said server being connected directly to the subsaiber 
authorization ^steim^ X -J xr- . ; . 

6. A conditional access system accordinga;to Claim 5, further comprising a 
25 receiver/decoder for the subscriber, the receiver/decoder being connectable to said 
communications server, and hence to said subscriber authorization system, via a 
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modem and telephone link. t v ! - 

rl' : A broadcast aijd reception system inclyding a conditional access system 
according to .any preceding claim. . ; - ^ - . ^ 

8. A broadcast and reception system comprising: 

5 ■ . meaiisrfor generating a pliurality of OTtitlement messages relating to broadcast 

■ . - programs; , . - :,h,-j l ■ .. cz.a • . . ' 

means for receiviijg said messages from said .generating means; and^ : 
means for cpgnecting the Tccfeiying means^to the jgenerating means to receive 
said messages, said connecting means being capable of effecting a dedicated 
10 connection between, the receiving means and the generating means. 

9. A broadcast and reception system comprising: " . ^ r: r : = ^ ^ 

; V ^ : mcan^ ft)r generating a.pluipHty:Of r entitlement me^^ relating to broadcast 
programs; : • . ^n: - 

means for receiving said messages from said generating means via a modem; 
IS,.. :and - ^.-c • .iv.^/ r .^Z v . 

means for connecting said modem to^said generating means and said receiving 

means. 

/ '--^-L.. ■ - : > • . .vii. o:.' ^t'^ A . 

10. A broadcast :and reception: system -^acoird^^ Claim 9, wherein said 
generating means is connected to said modem via a communications server:^ : 

20 11,L A broadcast and reception systerii according to Claim 9 or 10, wherein said 
receiving means is adapted to commimicate with said generating means via said 
modem and connecting means. 

12. A broadcast and: reception system according: -tp Claim tl, wherein said 
i^sceiving means comprises means: for reading a sinartcard insertable thereinto by an 
25 end user, the smartcard having stored, thcrem data to initiate automatically the 
transmission of a message from said receiving means to said generating means upon 
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insertion of the smartcard by the end user. ' ' 

13. ,:.. A broadcast and reception system aaiordiJig -to Claiin llof 12, further 
comprising a voice link to enable the end user of the brbadcast and reception-system 
to communicate with the generating means. 

5 14- A-broadcast and reception system 'according tp ariy-0f Qamis 8 tb 13, wherein ' 
said receiving means comprises a receiver/decoder comprising means for receiving a 
compressed MPEG-type signal/mieans^for de^ .the received signal' to provide a 
r . television .signal and means for:supplying:^etetevis^t(^^ignarto a television. 

IS. A broadcast and reception system, comprisiiigv at the brdadcasit ends* 
10 a broadcast system including means for broadcasting a callback request; ^ 



and at the reception end: 



a receiver meluding lae^ifr tfoi^'<:aU bi;ck th^ broadcast ^stfem in response 
to the callback request. ' -i' > '-"^ 

16. A system according to Claim 15, wherein the means for calling b^Ck the' 
15 rbroadcastjsystem. includes a mpdemoconnectable to a tblephotie system.^ ^ 

17. A system according to Qaim 15 or 16, wherein the means for calling back the 
broadcast system is iaixanged to . transfer \ to ^ the broadcast ": system^ information 
conperaing the receiver. , r >o"r r-. - - r " ^ ^ v^f: i \ 

18. A system according to Claim 17, wherein tijc broaAsaSt systeni includes means 
20 for storing &e informatibaai. i'i ^ . s inifi n::/./ : : ^- : . r 

19. A system according to any of Claims 15 to 18, wherein the broadcast means 
is ariang^ to . broadcasts callback -request vwhich includ^esva command that the 
callback be made at a given time, ^d the means:2f or calling back the broadcast system 
is. arranged to respond .to said conmiand; c. .:^ ./ ; • ; = l 
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20. A system according to any of Qaims 15 to 19, wherein the broadcasting means 
is arranged to broadcast as the callback request one or more entitlement messages for 
broadcast. ' v- ' 

21. A system according to any of Oaims 15 to 20, wherein the broadcast system 

5 includes means for generatirig"a check message and passing this to the receiver, the 
receiver includes means for eiicfypHng the check message and passing this to the 
broadcast system, and the broadcast system further includes means for decrypting the 
check message received from the receiver and comparing this with the original check 
message. ^ \ . . 

10 22. A conditional access system or a broadcast and reception system substantially as 
herein described with reference to and as illustrated .in the accompanying drawings, 
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